CVE-2026-4879 Overview
CVE-2026-4879 is a missing authorization vulnerability [CWE-862] in GitLab Enterprise Edition (EE). The flaw affects a merge request API endpoint that fails to enforce role-based access restrictions on external status check configuration. An authenticated user holding developer-role permissions can view external status check configuration intended for higher-privileged roles. GitLab has released patches addressing the issue across the affected release branches.
Critical Impact
An authenticated developer-role user can read external status check configuration restricted to higher-privileged roles, exposing configuration data that supports merge request compliance and gating workflows.
Affected Products
- GitLab EE versions 16.0 through versions prior to 19.0.6
- GitLab EE versions 19.1 through versions prior to 19.1.4
- GitLab EE versions 19.2 through versions prior to 19.2.2
Discovery Timeline
- 2026-08-12 - CVE-2026-4879 published to the National Vulnerability Database (NVD)
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-4879
Vulnerability Analysis
The vulnerability resides in a merge request API endpoint that exposes external status check configuration in GitLab EE. External status checks integrate GitLab merge requests with third-party services that must approve or reject changes before they merge. Configuration data for these checks is intended to be visible only to users holding maintainer or higher permissions.
The affected endpoint returns external status check configuration without verifying the caller's project role. A user with developer-role permissions can invoke the endpoint and receive data reserved for higher-privileged roles. The disclosed configuration may include integration URLs and rule metadata that describe how compliance gates operate. Successful exploitation requires an authenticated session with at least developer-role access to the target project.
Root Cause
The root cause is a missing authorization check [CWE-862] on the merge request API endpoint that serves external status check configuration. The endpoint validates that the caller is authenticated and belongs to the project, but it does not evaluate whether the caller's role meets the minimum required for viewing status check configuration. The result is a horizontal-to-vertical information exposure where lower-privileged users read data reserved for higher-privileged roles.
Attack Vector
Exploitation occurs over the network against a GitLab EE instance. The attacker must hold valid credentials for a project where they have at least developer-role permissions. The attacker then issues API requests to the affected merge request endpoint and receives external status check configuration in the response. Refer to the GitLab Work Item Documentation and the HackerOne Vulnerability Report for further technical context.
Detection Methods for CVE-2026-4879
Indicators of Compromise
- API access log entries showing requests to merge request external status check endpoints originating from accounts that hold only developer-role permissions.
- Repeated enumeration of merge request endpoints across multiple projects by the same developer-role account within a short window.
Detection Strategies
- Review GitLab production API logs for requests to external status check routes and correlate the caller's project role at request time.
- Build a baseline of expected API consumers for external status check endpoints and alert on deviations from that baseline.
- Hunt for anomalous access patterns from personal access tokens or CI job tokens tied to developer-role users.
Monitoring Recommendations
- Forward GitLab production_json.log and api_json.log to a central analytics platform and retain them for retrospective review.
- Alert on any successful HTTP 200 responses to external status check API paths where the requesting user is not a maintainer, owner, or administrator.
- Track configuration changes to external status checks and correlate with the identity of the querying user.
How to Mitigate CVE-2026-4879
Immediate Actions Required
- Upgrade GitLab EE to version 19.0.6, 19.1.4, or 19.2.2, matching the branch currently in production.
- Audit project membership and remove developer-role access for accounts that no longer require it.
- Rotate external status check integration secrets if logs indicate unauthorized reads occurred.
Patch Information
GitLab addressed the issue in GitLab EE 19.0.6, 19.1.4, and 19.2.2. Details are published in the GitLab Patch Release Note. Self-managed administrators should apply the patch corresponding to their current release branch. GitLab.com SaaS tenants receive the fix as part of the vendor's managed rollout.
Workarounds
- Restrict use of external status checks to projects where all developer-role members are already trusted to view integration configuration.
- Limit project developer-role assignments to internal users and remove external collaborators from projects that use external status checks until patching is complete.
# Verify the installed GitLab version on a self-managed instance
sudo gitlab-rake gitlab:env:info | grep -i version
# Debian/Ubuntu upgrade example for GitLab EE 19.2.2
sudo apt-get update
sudo apt-get install gitlab-ee=19.2.2-ee.0
# RHEL/CentOS upgrade example for GitLab EE 19.2.2
sudo yum install gitlab-ee-19.2.2-ee.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
